Installing a new cert

palomed — Tue, 22 Mar 2022 19:06:35 GMT

For Global Protect I currently have a server cert on my PAN 3220. When i imported it it had the entire chain - root, intermediate and the server cert. That server cert is now nearing expiration. I gave our cert manager a CSR from the PAN and I now have the new .PEM formatted server cert with longer expiry and the chain which includes the root and intermediate certs.

1) Can I install this into the device certificates store under a different certificate name? And this would not affect the existing certificate profile.

2) To upgrade to the new cert my plan would be to change the certificate profiles to point to the new server cert and then test that Global Protect is authenticating OK. If the cert based auth GP was failing then I would change back the cert profile to point to the old certificate. Does this sounds like a reasonable approach?

Re: Installing a new cert

addawes — Tue, 22 Mar 2022 20:22:21 GMT

If you try to upload a cert that is a renewal of an identical cert - the fw will likely just replace the existing one with the new one. The name you give it on the fw will not matter. The fw will see the body of the certificate is identical to one already installed that just has an extended expiration date, and update the existing cert with the new name you gave it.

I'm certainly no certificate expert. But I've had the best luck using the shotgun method. Delete the existing cert chain then upload the updated cert chain.

topic Installing a new cert in General Topics

Installing a new cert

Re: Installing a new cert